No Crew to Kidnap: How Autonomy Rewrites Maritime Security Risk

WEEK 16 | APRIL 2026

In June 2021, Ocean Infinity acquired Ambrey. On the surface, a straightforward corporate transaction: a maritime technology company buying a security consultancy. Look closer and it’s something else entirely.

Ambrey was founded in 2010 in Hereford, UK, by ex-British military personnel at the peak of the Somali piracy crisis. Its core business was simple and brutal: put armed guards on ships so pirates couldn’t take the crew hostage. By the time Ocean Infinity bought it, Ambrey had grown into one of the world’s largest maritime security firms, protecting more vessels than almost any competitor. Ocean Infinity, meanwhile, had just completed construction of the first vessels in what would become the world’s largest commercial fleet of lean-crewed autonomous offshore ships.

One company’s corporate history maps perfectly onto the transformation this piece is about. The threat model that built Ambrey is becoming obsolete. The world Ocean Infinity is building has no equivalent security architecture to replace it.

That gap, legal, doctrinal, and financial, is what this deep dive is about.

Between 2008 and 2012, Somali pirates took roughly 3,741 crew members of 125 nationalities hostage across 125 vessels. They collected between $339 million and $413 million in ransoms, the World Bank’s best estimate from its 2013 analysis of the crisis. Average ransom in 2011: approximately $5 million per vessel. Average negotiation duration: 178 days. The single largest payment: $13.5 million for the Greek-owned VLCC Irene SL.

The international community’s response to this was comprehensive, coordinated, and entirely human-centric.

Best Management Practices evolved from BMP1 in 2009 through BMP5 in 2018, formalising citadel protocols, transit corridor procedures, and the conditions under which armed guards could operate. The IMO’s guidance on Privately Contracted Armed Security Personnel followed in 2011, a framework developed specifically because the major maritime organisations had previously opposed armed guards aboard merchant ships. The UK announced authorisation for armed guards on October 30, 2011. Germany followed in March 2013. Within two years of peak piracy, the industry had built an entire private security ecosystem from scratch.

By all available accounts, no ship with armed guards was ever successfully hijacked during the Somali piracy era. The combination of BMP compliance, naval presence from EU NAVFOR Atalanta and NATO Ocean Shield, and the deterrent effect of armed security teams broke the business model. Piracy collapsed after 2012. The Indian Ocean High Risk Area designation was lifted in January 2023.

The Gulf of Guinea then demonstrated that the human-centric model was the model, not just one option among many. West African piracy operates on a different economics: not ship-and-crew ransoms held for months, but kidnap-for-ransom targeting the two to six most valuable crew members, typically the master and chief engineer, held ashore in the Niger Delta for three to eight weeks at $30,000 to $100,000 per group. In 2020, the Gulf of Guinea accounted for over 95% of maritime kidnappings globally. By 2021, it accounted for 100%.

Different geography, different tactics, identical logic. Crew are the target because crew have ransom value. Armed guards, citadels, naval escorts, emergency satellite communications: everything the maritime security industry built assumes humans aboard who need protecting, rescuing, or ransoming.

Remove the crew and the entire architecture has nothing to protect.